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Abstract. We compute in a direct (not algorithmic) way the zeta function 
of all supersingular curves of genus 2 over a finite field k, with many geometric 
automorphisms. We display these computations in an appendix where we 
select a family of representatives of all these curves up to fc-isomorphism and 
we exhibit equations and the zeta function of all their fc/fc-twists. As an 
application we obtain a direct computation of the cryptographic exponent of 
the Jacobians of these curves. 



Introduction 

One-round tripartite Difnc-Hcllman, identity based encryption, and short digital 
signatures are some problems for which good solutions have recently been found, 
making critical use of pairings on supersingular abelian varieties over a finite field 
k. The cryptographic exponent ca of a supersingular abelian variety A is a half- 
integer that measures the security against an attack on the DL problem based on 
the Weil or the Tate pairings. Also, it is relevant to determine when pairings can 
be efficiently computed. Rubin and Silverberg showed in [RS04] that this invariant 
is determined by the zeta function of A. 

In this paper we give a direct, non-algorithmic procedure to compute the zeta 
function of a supersingular curve of genus 2, providing thus a direct computation of 
the cryptographic exponent of its Jacobian. This is achieved in Sect. [T] For even 
characteristic the results are based on MN06J and are summarized in Table O for 
odd characteristic we use results of Xing and Zhu on the structure of the group of 
fc-rational points of a supersingular abelian surface and we almost determine the 
zeta function in terms of the Galois structure of the set of Weierstrass points of the 
curve (Tables [3l |4]). In the rest of the paper we obtain a complete answer in the case 
of curves with many automorphisms. In Sect. [2] we study the extra information 
provided by these automorphisms and we show how to obtain the relevant data to 
compute the zeta funtion of a twisted curve in terms of data of the original curve 
and the 1-cocycle defining the twist. In Sect. [3] we select a family of representatives 
of these curves up to /c-isomorphism and we apply the techniques of the previous 
section to deal with each curve and all its fc/fc-twists. The results are displayed in 
an Appendix in the form of tables. 

In what cryptographic applications of pairings concerns, curves with many au- 
tomorphisms are interesting too because they are natural candidates to provide 
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distortion maps on the Jacobian. In this regard the computation of the zeta func- 
tion is a necessary step to study the structure of the endomorphism ring of the 
Jacobian (cf. |GPRS06p . 



1. Zeta Function and Cryptographic Exponent 



Let p be a prime number and let k = ¥ q be a finite field of characteristic p. 
We denote by k n the extension of degree n of k in a fixed algebraic closure k, 
Gk ■= Gal(fc/fc) is the absolute Galois group of k, and a £ Gk the Frobenius 
automorphism. 

Let C be a projective, smooth, geometrically irreducible, supersingular curve of 
genus 2 defined over k. The Jacobian J of C is a supersingular abelian surface over 
k (the p-torsion subgroup of J(k) is trivial). Let us recall how supersingularity is 
reflected in a model of the curve C: 

Theorem 1.1. If p is odd, any curve of genus 2 defined over k admits an affine 
Weierstrass model y 2 — f(x), with f{x) a separable polynomial in k[x] of degree 5 
or 6. The curve is supersingular if and only if M^M — 0, where M , are the 



If p = 2 a curve of genus 2 defined over k is supersingular if and only if it admits 
an affine Artin-Schreier model y 2 + y = f(x), with f(x) an arbitrary polynomial in 
k [x] of degree 5 . 

For the first statement see |Yui78j or |IKQ86| . for the second see |W92j . 

For any simple supersingular abelian variety A defined over k, Rubin and Silver- 
berg computed in [RS04] the cryptographic exponent ca, defined as the half-integer 
such that q CA is the size of the smallest field F such that every cyclic subgroup of 
A(k) can be embedded in F* . This invariant refines the concept of embedding de- 
gree, formerly introduced as a measure of the security of the abelian variety against 
the attacks to the DLP by using the Weil pairing [MOV93] or the Tate pairing 
[FR94] (see for instance [GalOl] ). 

Let us recall the result of Rubin-Silverberg, adapted to the dimension two case. 
After classical results of Tate and Honda, the isogeny class of A is determined by 
the Weil polynomial of A, /^(x) — x 4 + rx 3 + sx 2 + qrx + q 2 6 1[x\, which is 
the characteristic polynomial of the Frobenius endomorphism of the surface. For A 
supersingular the roots of /a(#) in Q are of the form y/qC,, where Jq is the positive 
square root of q and C, is a primitive m-th root of unity. 

Theorem 1.2. Suppose A is a simple supersingular abelian surface over ¥ q and 
let £ > 5 be any prime number dividing \A(¥ q )\. Then, the smallest half-integer Ca 
such that q CA — 1 is an integer divisible by £ is given by 



In particular, the cryptographic exponent ca is an invariant of the isogeny class 
of A. The complete list of simple supersingular isogeny classes of abelian surfaces 
can be found in |MN02| Thm. 2.9]. It is straightforward to find out the m-th root 
of unity in each case. We display the computation of ca in Table [TJ 
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matrices: 





if q is a square, 

if q is not a square . 



Table 1 . Cryptographic exponent ca of the simple supersingular 
abelian surface A with Weil polynomial Ja(x) — x 4 + rx 3 + sx 2 + 
qrx + q 2 



(r,s) 


conditions on p and g 




(0,-2g) 


q nonsquare 


1 


(0,2?) 


q square, p = 1 (mod 4) 


2 


(2^q,3q) 


g square, p = 1 (mod 3) 


3/2 


{-2y/q, 3g) 


g square, p= I (mod 3) 


3 


(0,0) 


(g nonsquare, p ^ 2) or (g square, p ^ 1 (mod 8)) 


4 


(0,9) 


g nonsquare 


3 


(o,-?) 


(g nonsquare, p ^ 3) or (g square, p ^ 1 (mod 12)) 


6 




g square, p ^ 1 (mod 5) 


5/2 


9) 


g square, p ^ 1 (mod 5) 


5 


(±V^,3g) 


g nonsquare, p = 5 


5 


(±V2g,g) 


q nonsquare, p = 2 
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Therefore, the computation of the cryptographic exponent of the Jacobian J of 
a supersingular curve C amounts to the computation of the Weil polynomial of J, 
which is related in a well-known way to the zeta function of C. We shall call fj{x) 
the Weil polynomial of C too. 

The computation of fj(x) has deserved a lot of attention because for the crypto- 
graphic applications one needs to know the cardinality | J(F 9 )| = of the group 
of rational points of the Jacobian. However, in the supersingular case the current 
"counting points" algorithms are not necessary because there are more direct ways 
to compute the polynomial fj(x). 

The aim of this section is to present these explicit methods, which take a different 
form for p odd or even. For p = 2 the computation of fj{x) is an immediate 
consequence of the methods of M N06j . based on ideas of van der Geer-van der 
Vlugt; for p > 2 we derive our results from the group structure of J(F 9 ), determined 
in |Xin96j , [ZhuOO] , and from the exact knowledge of what isogeny classes of abelian 
surfaces do contain Jacobians HNR06 . In both cases we shall show that fj (x) is 
almost determined by the structure as a Galois set of a finite subset of k, easy to 
compute from the defining equation of C. 

1.1. Computation of the Zeta Function when p = 2. We denote simply by 
tr the absolute trace tr fc / F2 . Recall that ker(tr) = {x + x 2 | x £ k} is an F2-linear 
subspace of k of codimension 1. 

Every projective smooth geometrically irreducible supersingular curve C of genus 
2 defined over k admits an affine Artin-Schreier model of the type: 

C : y 2 + y = ax 5 + bx 3 + cx + d, a 6 k* , b, c, d & k, 

which has only one point at infinity [VV92] . The change of variables y = y + u, 
iiei, allows us to suppose that d = or d = da, with do 6 fc\ker(tr) fixed. Twisting 
C by the hyperelliptic twist consists in adding d Q to the defining equation. If we 
denote by J' the Jacobian of the twisted curve we have fj>(x) = fj{—x). Thus, for 
the computation of fj(x) we can assume that d = 0. 

The structure as a Gfc-set of the set of roots in k of the polynomial P(x) — 
a 2 x 5 + b 2 x + a e k[x] almost determines the zeta function of C MN06| Sect. 3]. 

3 



Table 2 . Weil polynomial x 4 + rx 3 + sx 2 + qrx + q 2 of the curve 
y 2 + y = ax 5 + 6a; 3 + cx, for q nonsquare (left) and q square (right) 









P(x) 


N, M 


(r,s) 


P(x) 


N, M 


(r,s) 




(5) 






(1)(4) 


N = 


(±V2^,2g) 






N = 


(0,-9) 




N = 1 


(0,0) 




(1) 2 (3) 


TV = 1 


(0,9) 


(2)(3) 


M = 


(±\/2g,g) 






N = 2 


(±2^9,39) 




M = 1 


(0,9) 






M = 


(±2^9,29) 




N = 


(±2y2^,4g) 




(1)(2) 2 


M = 1 


(0,0) 


(1) 3 (2) 


N = 1 


(0,2q) 






M = 2 


(0,2 9 ) 




TV = 2 


(0,0) 






TV = 1 


(0,-29) 




TV = 3 


(0,-2g) 




(I) 5 


N = 3 


(0,2 g ) 










TV = 5 


(±V9,69) 



In Table [2] we write P(x) = (ni) ri {n2) T2 • ■ ■ (n m ) Tm to indicate that of the 
irreducible factors of P(x) have degree Uj. Also, we consider the linear operator 
T(x) := tr((c + b 2 a~ 1 )x) and we define 

N := number of roots z e fc of F(x) s.t. T(z) = 0, 

M := number of irred. quadratic factors x 2 + vx + w of P{x) s.t. T(v) = . 

The ambiguity of the sign of r can be solved by computing nD in the Jacobian, 
where n is one of the presumed values of |J(F g )| and D is a random rational divisor 
of degree 0. 

1.2. Computation of the Zeta Function when p is odd. Let A be a super- 
singular abelian surface over k and let rk^-A) := dimf 2 (A[2] (fc)). 

The structure of A(k) as an abelian group was studied in |Xin96j . [ZhuOOj . where 
it is proven that it is almost determined by the isogeny class of A. In fact, if Fi(x) 
are the different irreducible factors of /a(x) in Z[x]: 

s 

Sa{x) = J| Fi(x) e % 1 < s < 2 =>■ A(fc) ~ ® s t=1 (Z/Fi(l)Z) e * , 
t=i 

except for the following cases: 

(a) p = 3 (mod 4), q is not a square and /a(x) — (x 2 + q) 2 , 

(b) p = 1 (mod 4), 9 is not a square and /a(x) = (x 2 — q) 2 . 

(c) <? is a square and /a(x) = (x 2 — q) 2 . 

The possible structure of A(k) in cases (a) and (b) is: 

A(k) ~ (Z/F(l)Z) m © (Z/(F(1)/2)Z Z/2Z)" , 

where -F(x) denotes respectively x 2 + q, x 2 — q, and m, n are non-negative integers 
such that m + n = 2 [ZhuOO, Thm. 1.1]. In case (c) we have either: 

A(k) ~ (Z/((g - 1)/2)Z) 2 © (Z/2Z) 2 , or 

A{k) ~ (Z/((g - l)/2 m )Z) © (Z/((g - 1)/2™)Z) © (Z/2 m +"Z) , 

where < m, n < v 2 (q — 1) [Xin96, Thm. 3]. In this last case we have rk.2(A) > 1; 
in fact, ^(l - y/q) + v 2 (l + y/q) = v 2 (l - 9) = (l/2)v 2 (F(l)) and we can apply 
Xin96, Lcm. 4] to conclude that A(k) has a subgroup isomorphic to (Z/2Z) 2 . 
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Table 3. Weil polynomial x A + rx 3 + sx 2 + qrx + q 2 of the curve 
C when q is nonsquare. The sign e is the Legendre symbol (— 1/p) 



w 


P 


rk 2 (J) 


(r,s) 


[lj or [l) (Z) 




4, d 




(l)*(2) a or (2f 




2 


(0,±2g) 


(1) 3 (3) 




2 


not possible 


(1)(2)(3) 


p > 3 
P = 3 


1 


not possible 

(±V3q,2q) 


(1)^(4) or (2)(4) 




1 


(0,0) 


(1)(5) 


p^5 
p — 5 





not possible 

(±V5g,3g) 


(3) 2 


p = 1 (mod 3) 
p = — 1 (mod 3) 
p = 'i 





(0,9) 
(0,c«) 

not possible 


(6) 


p = — 1 (mod 3) 
p ^ —1 (mod 3) 





(0,±g) 
(0,?) 



Consider now a supersingular curve C of genus 2 defined over k, given by a 
Weierstrass equation y 2 — f(x), for some separable polynomial f(x) £ k[x] of degree 
5 or 6. Let J be its Jacobian variety, W = {P , Px,P%, -P3, P4, P5} Q C(k) the set of 
Weierstrass points of C, and W(k) C W the subset of fc-rational Weierstrass points. 
Our aim is to show that the structure of W as a G^-set contains enough information 
on the 2-adic value of |C(fc)| and |J(fc)| to almost determine the polynomial fj(x) = 
x A + rx 3 + sx 2 + qrx + q 2 . 

From the fundamental identities 

\C(k)\ =q + l+r, \J(k)\ = fj(l) = (q 2 + 1) + (q + l)r + s, 
and the free action of the hypereUiptic involution on C{k) \ W(k) we get 
(1) r = \W(k)\ (mod 2), s = \ J(k)\ (mod 2) . 

On the other hand, J[2] is represented by the classes of the 15 divisors: 

Pi-Pa, 1 < i < 5, and P l + P 3 - 2P , 1 < « < j < 5, 
together with the trivial class. 

Lemma 1.3. Let D = Pi — Pj, with i ^ j, or D = Pi + Pj — 2Pq, with 0, i, j 
pairwise different. Then, the class of the divisor D is k-rational if and only if Pi, Pj 
are both k-rational or quadratic conjugate. 

Hence, the Galois structure of W determines rlt2( J) and this limits the possible 
values of the zeta function of C. Our final results are given in Tables [3l[4l where 
we write W — {ni) ri (n 2 ) r2 ■ ■ ■ (n m ) rm to indicate that there are r*j Gfc-orbits of 
length rii of Weierstrass points. If f(x) has degree 6 this Galois structure mimics 
the decomposition f(x) = (ni) ri («2) r2 • ■ • {n m Y m (same notation as in Sect. II. ip of 
f(x) into a product of irreducible polynomials k[x\. If f(x) has degree 5 then W = 
(l)f(x), because in these models the point at infinity is a fc-rational Weierstrass 
point. 

The proof of the content of Tables 3 and 4 is elementary, but long. Instead of 
giving all details we only sketch the main ideas: 
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Table 4. Weil polynomial x A + rx 3 + sx 2 + qrx + q 2 of the curve 
C when q is a square 



VV 


P 


rK 2 W ; 


(r, s) 






4 


(0 — 2o1 or f+4 /77 tin) 


(1) 4 (2) 




3 


(0,-2?) 


(1) 2 (2) 2 or (2) a 




2 


(0,±2?) 


(1) 3 (3) 


p>3 


2 


not possible 




P = 3 




(±^,o) 


(1)(2)(3) 




1 


not possible 


(If (4) or (2)(4) 


p = 1 (mod 8) 


1 


not possible 




p ^ 1 (mod 8) 




(0,0) 


(1)(5) 


p = 1 (mod 5) 





not possible 




p ^ 1 (mod 5) 






(3) 2 






(0,g)or (±2Vg,3g) 


(6) 


p = 5 (mod 12) 





(0,±g) 




p 5 (mod 12) 




(o,g) 



(I) Waterhouse determined all possible isogeny classes of supersingular elliptic 
curves Wat69j . Thus, it is possible to write down all isogeny classes of supersingular 
abelian surfaces by adding to the simple classes given in Table [T] the split isogeny 
classes. By HNR06] we know exactly what isogeny classes of abelian surfaces do 
not contain Jacobians and they can be dropped from the list. By the results of Xing 
and Zhu we can distribute the remaining isogeny classes according to the possible 
values of rk2 . 

(II) Each structure of W as a G^-set determines the value of rk2 and, after (I), 
it has a reduced number of possibilities for the isogeny classes. By using ((TJ and 
looking for some incoherence in the behaviour under scalar extension to hi or of 
both, the Galois structure of W and the possible associated isogeny classes, we can 
still discard some of these possibilities. 

In practice, among the few possibilities left in Tables 3 and 4 we can single out 
the isogeny class of the Jacobian of any given supersingular curve by computing 
iterates of random divisors of degree zero. However, if C has many automorphisms 
they provide enough extra information to completely determine the zeta function. 
This will be carried out in the rest of the paper. In the Appendix we display 
equations of the supersingular curves with many automorphisms and their Weil 
polynomial. 



2. Zeta Function of Twists 

In this section we review some basic facts about twists and we show how to 
compute different properties of a twisted curve in terms of the defining 1-cocycle. 
From now on the ground field k will have odd characteristic. 

Let C be a supersingular curve of genus 2 defined over k and let W C C(k) 
be the set of Weierstrass points of C. We denote by Aut(C) the fc-automorphism 
group of C and by Autjr(C) the full automorphism group of C. 
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Let 4>: C — ► P 1 be a fixed fc-morphism of degree 2 and consider the group of 
reduced geometric automorphisms of C: 

Aut^(C) := {«' G Aut^P 1 ) | u{cf>{W)) = <f>{W)} . 

We denote by Aut'(C) the subgroup of reduced automorphisms defined over fc. 
Any automorphism u of C fits into a commutative diagram: 




for certain uniquely determined reduced automorphism v! . The map u i— > u' is a 
group homomorphism (depending on 0) and we have a central exact sequence of 
groups compatible with Galois action: 

1 — ►{!.,£,} — ► Au%(C) Aut^(C) — ► 1, 

where t is the hyperelliptic involution. This leads to a long exact sequence of Galois 
cohomology sets: 

(2) 1 -> -> Aut(C) Aut'(C) -i ^(Gfcjl^}) -> ff^Gfc, Au%(C)) -> 

-> ^(Gfe, Autjf(C)) ff 2 (G fc! {l, 4) - Br 2 (fc) = . 

The fc/fc- twists of C are parameterized by the pointed set i? 1 (G / t, Autr(C)) 
and, since k is a finite field, a 1-cocycle is determined just by the choice of an 
automorphism v € Autr(G). The twisted curve C v associated to v is defined over 
k and is determined, up to fc-isomorphism, by the existence of a fc-isomorphism 
/: C — >C V , such that f- 1 f a = v. 

For instance, the choice v = L corresponds to the hyperelliptic twist C'\ if C is 
given by a Weierstrass equation y 2 = f(x) then C admits the model y 2 = tf(x), for 
t G k*\(k*) 2 . We say that C is self-dual if it is ^-isomorphic to its hyperelliptc twist. 
If fj(x) is the Weil polynomial of C, the Weil polynomial of C is fj'(x) — fj(—x); 
in particular, for a self-dual curve one has fj(x) = a; 4 + sx 2 +q 2 for some integer s. 

It is easy to deduce from ([2]) the following criterion for self-duality: 

Lemma 2.1. The curve C is self-dual if and only if | Aut (G)| = | Aut(C)|. 

One can easily compute the data Aut(C u ), Aut'(G„) of the twisted curve C v , in 
terms of Aut-^(C), Autr-(C) and the 1-cocycle v. 

Let /: C — ► C v be a geometric isomorphism such that = v. We have 

Aut^r(G„) = / Autjr(C)/ -1 , and the fc-automorphism group is 

(3) Aut{C v ) = {fuf- 1 | u G Au%(G), uv =d/} . 

Once we fix any fc-morphism of degree two, <p v : C v — > P 1 , it determines a unique 
geometric automorphism /' of P 1 such that <j> v f — f'4>- The reduced group of 
fc-automorphisms of C v is 

(4) Aut' (a) = {fu'wr 1 1 u 1 g Aut^c), u' v' = v'iu'ry . 

In order to compute the zeta function of C v we consider the geometric isomor- 
phism /: J — > J v induced by /. We still have f~ 1 f a — «*, where is the 
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automorphism of J induced by v. Clearly, % v f = / CT 7r, where tt, tt v are the respec- 
tive g-power Frobenius endomorphisms of J, J v . Hence, 

In particular, n v has the same characteristic polynomial than v^n. From this fact 
one can deduce two crucial results (cf. HNR06, Props. 13. 1,13. 4]). 

Proposition 2.2. Suppose q is a square. Let C be a supersingular genus 2 curve 
over k with Weil polynomial (x + *Jq) A and let v be a geometric automorphism of 
C, v ^ 1, l. Then, the Weil polynomial x^ + rx 3 +sx 2 + rx + q 2 of C v is determined 
as follows in terms of v (in the column v 6 — 1 we suppose v 2 ^ 1, v 3 ^ l,t): 



V 


v 2 =l 


v 2 — i 


v 6 = 1 


V 3 = i 


4 

V = L 


v b = 1 




v b = 1 


V b = L 


(r, s) 


(0,-2?) 


(Q,2g) 


(-2^,3?) 


(2^,3?) 


(0,0) 




(a/5,9) 


(0,9) 





Proposition 2.3. Suppose q is nonsquare. Let C be a supersingular genus 2 curve 
over k with Weil polynomial (x 2 + eg) 2 , e G {1,-1}, and let v be a geometric 
automorphism of C . Then, the Weil polynomial x A + rx 3 + sx 2 + rx + q 2 of C v is 
determined as follows in terms of the order n of the automorphism vv a : 



n 


1 


2 


3 


4 


6 


(r,s) 


(0,2eq) 


(0,-2eq) 


(0,-eq) 


(0,0) 


(0,e<z) 



In applying these results the transitivity property of twists can be helpful. 

Lemma 2.4. Let u,v be automorphisms of C and let f ': C — > C v be a geometric 
isomorphism with f~ 1 f a = v. Then the curve C u is the twist of C v associated to 
the automorphism fuv~ 1 f~ 1 ofC v . 

For a curve with a large fc-automorphism group the following remark, together 
with Tables |3] and |H determines in some cases the zeta function: 

Lemma 2.5. Let J- C C(k) be the subset of k-rational points of C that are fixed 
by some non-trivial k- automorphism of C Then, 

\C(k)\ = \F\ (mod | Aut(C)|) . 
Proof. The group Aut(C) acts freely on C(k) \T. □ 

Note that T contains the set W(k) of fc-rational Weierstrass points, all of them 
fixed by the hyperelliptic involution i of C . 

In order to apply this result to the twisted curve C v we need to compute the 
Gfe-set structure of W v and solely in terms of v. 

Lemma 2.6. (1) For any P £ W the length of the Gk-orbit of f(P) £ W v is 
the minimum positive integer n such that v v a ■ ■ ■ v a (P a ) = P. In particular, 
\W v {k)\ = \{P£ W | v{P°) =P}\. 

(2) The map / _1 stablishes a bijection between T v and the set 
{P £ C(k) | v(P a ) = P = u{P) for some l^u£ Au%(C), s.t. uv = 

3. Supersingular curves with many automorphisms 

For several cryptographic applications of the Tate pairing the use of distor- 
tion maps is essential. A distortion map is an endomorphism tjj of the Jacobian 
J of C that provides an input for which the value of the pairing is non-trivial: 
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ee(Di,i[>(D 2 )) 7^ 1 for some fixed ^-torsion divisors D\, D 2 . The existence of 
such a map is guaranteed, but in practice it is hard to find it in an efficient way. 
Usually, one can start with a nice curve C with many automorphisms, consider 
a concrete automorphism u 7^ 1, u 7^ l, and look for a distortion map ip in the 
subring Z[7T, w*] C End(J), where tt is the Frobenius endomorphism of J and is 
the automorphism of the Jacobian induced by u. If Z[7r, u„\ = End(J) it is highly 
probable that a distortion map is found. If Z[tt, «*] 7^ End(J) it can be a hard 
problem to prove that some nice candidate is a distortion map, but at least one is 
able most of the time to find a "denominator" m such that mip lies in the subring 
Z[-7r, u„\\ in this case, if £ \ m one can use mtp as a distortion map on divisors of 
order I. Several examples are discussed in |GPRS06] . 

The aim of this section is to exhibit all supersingular curves of genus 2 with 
many automorphisms, describe their automorphisms, and compute the character- 
istic polynomial of tt, which is always a necessary ingredient in order to analyze 
the structure of the ring Z[tt, it*]. Recall that a curve C is said to have many auto- 
morphisms if it has some geometric automorphism other than the identity and the 
hyperelliptic involution; in other words, if | Autj:(C)| > 2. 

Igusa found equations for all geometric curves of genus 2 with many automor- 
phisms, and he grouped these curves in six families according to the possible struc- 
ture of the automorphism group Igu60|, [IKO86J. Cardona and Quer found a faith- 
ful and complete system of representatives of all these curves up to fc-isomorphism 
and they gave conditions to ensure the exact structure of the automorphism group 
of each concrete model [Car03j . [CQ06|. The following theorem sums up these 
results. 



Theorem 3.1. Any curve of genus 2 with many automorphisms is geometrically 
isomorphic to one and only one of the curves in these six families: 



Equation of C 




Aut^(C) 


Au%(<7) 


y 2 = x ti + ax 4 + bx 2 + 1 


a, b satisfy {5p 


c 2 


C 2 x C 2 


5 r ^ 1 

y = x + x + ax 


a ^ 0, 1/4, 9/100 


C 2 x C 2 


Ds 


y 2 = x 6 + x 3 + a 


p^3, a 7^0, 1/4, -1/50 


s 3 


D 12 


y 2 = ax 6 + x 4 + x 2 + I 


p = 3, a / 


s 3 


D l2 


y 2 = X b - 1 


P^3, 5 




2D 12 


9 ^ 

y = x — x 


P/5 


Si 






p = 5 


PGL 2 (F 5 ) 


s 5 


y 2 = X b - I 




c 5 


C10 



(5) (4c 3 -d 2 )(c 2 -4d+18c-27)(c 2 -4d-110c+1125) ^ 0, c := ab, d := a 3 + b 3 . 

Ibukiyama-Katsura-Oort determined, using Theorem 11-11 when the last three 
curves are supersingular IKO86, Props. 1.11, 1.12, 1.13]: 

y 2 = x 6 — 1 is supersingular iff p = — 1 (mod 3) 
y 2 = x 5 — x is supersingular iff p = 5, 7 (mod 8) 
y 2 = x 5 — 1 is supersingular iff p = 2, 3,4 (mod 5) 

It is immediate to check that y 2 = ax 6 + x 4 + x 2 + 1 is never supersingular if 
p = 3. One can apply Theorem ll.ll to the other curves in the first three families to 
distinguish the supersingular ones. 
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Theorem 3.2. Suppose q is a square and let C be a supersingular curve belonging 
to one of the first five families of Theorem \3.1l Then there a twist of C with Weil 
polynomial (x + ^fq) 4 , and this twist is unique. 

Proof. Let £ be a supersingular elliptic curve defined over F p . By [IK086, Prop. 
1.3] the Jacobian J of C is geometrically isomorphic to the product of two supersin- 
gular elliptic curves, which is in turn isomorphic to E x E by a well-known theorem 
of Dcligne. The principally polarized surface (J, 0) is thus geometrically isomorphic 
to (E x E, A) for some principal polarization A. Since E has all endomorphisms 
defined over F p 2 , (E x E, A) is defined over F p 2 and by a classical result of Weil 
it is F p 2 -isomorphic to the canonically polarized Jacobian of a curve Co defined 
over F p 2 . By Torelli, Co is a twist of C. The Weil polynomial of Co is (x ± y/q) 4 
because the Frobenius polynomial of E is x 2 + p. The fact that Co and Cq are the 
unique twists of Co with Weil polynomial (x ± y/q) is consequence of Proposition 

El □ □ 

Corollary 3.3. Under the same assumptions: 

(1) The Weil polynomial of C is (x ± y/q) 4 if and only ifW = (l) 6 . 

(2) If C belongs to one of the first three families of Theorem \3.1\ then it admits 
no twist with Weil polynomial x ± qx 2 + q 2 or x 4 + q 2 . 

(3) // any of the curves y 2 = x 5 + x 3 + ax, y 2 = x e + x 3 + a is supersingular 
then a £ F p 2 . 

Proof. (1) By Table HJ the set Wq of Weierstrass points of Co has G^-structure 
Wq = (l) 6 and Lemma 12.61 shows that for all automorphisms v ^ 1,l one has 
W v ^ (l) 6 ; thus, only the twists C and C have W = (l) 6 . 

(2) The geometric automorphisms v of Co satisfy neither v 6 — 1, v 2 ^ 1, v 3, ^ 
1, l, nor v e — l, nor v 4 — i; thus, by Proposition 12.21 the Weil polynomial of a twist 
of Co is neither x 4 ± qx 2 + q 2 nor x 4 + q 2 . 

(3) The Igusa invariants of Co take values in F p 2 and a can be expressed in terms 
of these invariants |CQ05| . □ □ 

In a series of papers Cardona and Quer studied the possible structures of the 
pointed sets H 1 (Gk 1 Aut^fC)) and found representatives v £ Autjr(C) (identified 
to 1-cocycles of H 1 (Gk, Autjr(C))) of the twists of all curves with many automor- 
phisms [Car03 , |CQ05;, |Car06] . [CQ06|. In the next subsections we compute the 
zeta function and the number of /c-automorphisms of these curves when they are 
supersingular. A general strategy that works in most of the cases is to apply the 
techniques of Sect. [2] to find a twist of C with Weil polynomial (x ± y/q) 4 (for q 
square) or (x 2 ±q) 2 (for q nonsquare) and apply then Propositions 12 . 21 12T31 to obtain 
the zeta function of all other twists of C. The results are displayed in the Appendix 
in the form of Tables, where we exhibit moreover an equation of each curve. 

3.1. Twists of the curve C : y 2 — x 5 — 1, for p ^ 0, 1 (mod 5). We have 
4>{W) = {oo} U fj,5 and Aut^(C) ~ ^5. The zeta function of C can be computed 
from Tables 3,4 and Lemma l2~5l applied to C <£> &2- If q ^ 1 (mod 5) the only twists 
are C, C. If q = 1 (mod 5) there are ten twists and their zeta function can be 
deduced from Proposition 12.21 Table [5] summarizes all computations. 
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3.2. Twists of the curve C : y 2 = x 5 — x, for p = 5, 7 (mod 8). Now 4>(W) = 
{oo, 0, ±1, ±i}. If p = 5 we have Aut^(C) = AutQP 1 ). If p + 5 the group Aut^(C) 
is isomorphic to S4 and it is generated by the transformations T{x) — ix, S(x) — 

with relations S 3 = 1 = T 4 , ST 3 = T5 2 . For g nonsquare the zeta function of 
C is determined by Table [3l since the curve is defined over ¥ p we obtain the zeta 
function of C over k by scalar extension. 

In all cases we can apply Propositions 12.21 and 12 . 31 to determine the zeta function 
of the twists of C. Tables |H1 [H] summarize all computations. 

3.3. Twists of the curve C: y 2 — x 6 — 1, for p = — 1 (mod 3), p ^ 5. We have 

0(W) = Me and Aut^(C) = {±x, ±i]x, ±n 2 x, ± ±, ±2, ±^}, where 77 £ F p2 is a 
primitive third root of unity. 

The zeta function of C can be computed from Tables 3,4 and Lemma 12.51 applied 
to C and C<X> fca- The zeta function of all twists can be determined by Propositions 
12.21 12.31 Tables l9l fTOl summarize all computations. 

3.4. Twists of the supersingular curve C : y 2 — x 6 + x 3 + a, for p > 3. Recall 
that a is a special value making the curve C supersingular and a ^ 0, 1/4, —1/50. 
We have now 

&W) = {9, 7,0, V 2 0, 4 ^4). A <(C) = ^. -> »? 2 -}. 

K xxx 

where A, z, 6* € satisfy ^4 3 = a, z 2 + z + a = 0, 3 = z. 

The Galois action on W and on Aut^-(C) depends on z and a/z being cubes or 
not in their minimum field of definition k* or (fea)*. This is determined by the fact 
that a is a cube or not. 

Lemma 3.4. If a is a cube in k* then z, a/z are both cubes in k* or in (£2)*, 
according to 1 — 4a G (k*) 2 being a square or not. 

If a is not a cube in k* then z, a/z are both noncubes in k* or in (k 2 )* , according 
to 1 — 4a £ (k*) 2 being a square or not. 

Proof. Let us check that all situations excluded by the statement lead to W = 
(1) 3 (3) or W v = (1) 3 (3) for some twist, in contradiction with TablesElH 

Suppose q = —1 (mod 3). If 1 — 4a is a square then a, z, a/z are all cubes in k* . 
If 1 — 4a is not a square then a is a cube and if z, z a are not cubes in k 2 we have 
0° = lo{A/0), with w 3 = 1, w / 1, and the twist by v = (oj~ 1 (A/x), ^/ay/x 3 ) has 
W v = (1) 3 (3) by LemmaCLS 

Suppose a=l (mod 3). If 1 — 4a is not a square we have z^ q " 1 )/ 3 = a^ 9 " 1 )/ 3 , so 
that a is a cube in k* if and only if z, z a are cubes in k 2 ■ Suppose now that 1 — 4a is 
a square. If exactly one of the two elements z, a/z is a cube we have W = (1) 3 (3); 
thus z, a/z are both cubes or noncubes in k* . In particular, if a is not a cube 
then z, a/z are necessarily both noncubes. Finally, if a is a cube and z, a/z are 
noncubes in k* , Lemma T2.6I shows that W v = (1) 3 (3) for the twist corresponding 
to v — (r,x, y). □ □ 

For the computation of the zeta functions of the twists it is useful to detect that 
some of the combinations a square/nonsquare and 1 — 4a square/nonsquare are not 
possible. 

Lemma 3.5. Suppose q = 1 (mod 3). 

(1) If q = —1 (mod 4) then 1 — 4a is not a square. 
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(2) If q is nonsquare then a is not a square. 

(3) If q is a square then a and 1 — 4a are both squares. 

Proof. Let C v be the twist of C corresponding to v(x, y) — (nx,y). 

(1) Supose 1 — 4a is a square. If a is a cube we have W = (l) 6 and if a is not a 

cube we have W v = (l) 6 ; by Table [3] we get (r, s) = (0, —2 C — ^ q) in both cases. 

On the other hand, Lemmas 12.51 and 1 2.61 applied to C ®k &2 show in both cases that 
s = 1 (mod 3); thus, p = 1 (mod 4). 

(2) Suppose a is a square. If a is a cube (respectively a is not a cube) we 
have W = (l) 6 or W = (2) 3 (respectively W„ = (l) 6 or W« = (2) 3 ), according 
to 1 — 4a being a square or not. In all cases we have (r, s) = (0,±2q) by Table 
[3l and a straightforward application of Lemma \2. 51 and (2) of Lemma T2.6I leads to 
r = — 1 (mod 3), which is a contradiction. 

(3) In all cases in which a or 1 — 4a are nonsquares we get (r, s) = (0, q) either 
for the curve C or for the curve C v . This contradicts Corollary 13.31 □ □ 

After these results one can apply the general strategy. The results are displayed 
in Tables HUHaril 

3.5. Twists of the supersingular curve C : y 2 = x 5 + x 3 + ax. Recall that a is a 
special value making C supersingular and o^O, 1/4, 9/100. Given z £ k satisfying 
z 2 + z + a = we have <j)(W) — {0, oo, ±^/z, ±^/a/z}, 

Au%(C) = {(u; 2 x,Luy) | uj 4 = 1} U 

Lemma 3.6. If q = 1 (mod 4) then a and 1— 4a are both squares or both nonsquares 
in k* . If q is a square then necessarily a and 1 — 4a are both squares. 

Proof. If a g (fc*) 2 , l-4a € (fc*) 2 , then W = (1) 4 (2) and (r,s) = (0,-2q) by Tables 
13141 this contradicts Lemma l2~5l because | Aut(C)| = \T\ = 4 and r = 2 (mod 4). 

Suppose now a e (fc*) 2 , 1 - 4a g (fc*) 2 . If a G (fc*) 4 then = (1) 2 (2) 2 
and (r,s) = (0,±2g); this contradicts Lemma [2.51 because | Aut(C)| = 8, \J-\ = 6 
if q = 1 (mod 8) and IJ 7 ! = 2 or 10 if q = 5 (mod 8), so that r = 4 (mod 8) 
in both cases. If a ^ (fc*) 4 we get a similar contradiction for the curve C v for 

^(^y) = {~x,iy). 

If a, 1 — 4a are nonsquares, then W = (1) 2 (4) and the Weil polynomial of C is 
x 4 + q 2 by Tables 13141 If q is a square this contradicts Corollary 13.31 □ □ 

Lemma 3.7. If q is a square then a £ (fc*) 4 if and only if z £ (fc*) 2 . 

Proof. Suppose a £ (fc*) 4 , z (fc*) 2 and let us look for a contradiction. Consider 
the fc-automorphisms u(x,y) = (—x,iy), v(x,y) = (^-, ^y) of C, where w 4 = a. 
By Lemma [2. 6) W u = (l) 6 and C u has Weil polynomial (x ± y 7 ?) 4 by Corollary 
13.31 since w 2 = a, the Weil polynomial of C is (x 2 + q) 2 by Proposition 12.21 and 
Lemma 12.41 The quotient E :— C/v is an elliptic curve defined over fc and the 
Frobenius endomorphism n of E must satisfy it 2 — —q. Since q is a square, E has 
four automorphisms and its j invariant is necessarily qe = 1728. Now, E has a 
Weierstrass equation: Y 2 — (X + 2w)(X 2 + 1 — 2u> 2 ), where X = (x 2 + w 2 )x _1 , 
Y = y(x + w)x~ 2 are invariant under the action of v. The condition je — 1728 is 
equivalent to a = (which was excluded from the beginning) or a — (9/14) 2 ; in 
this latter case z is a square in F p 2 and we get a contradiction. 
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Suppose now a g" (fc*) 4 , z € (fc*) 2 . We have W = (l) 6 and C has Weil polynomial 
(x ± y/q) 4 by Corollary 13.31 By Proposition 12. 2[ the Weil polynomial of C u is 

(x 2 + q) 2 . For any choice of w = tfa, the morphism f(x, y) = (§±f , ^=f|g {x * w yi ) 
sets a ^-isomorphism between C and the model: 

C u : y 2 = (x 2 - l){x 4 + bx 2 + 1), b = (12^/5 - 2)/(2^ + 1), 

of C u . The quotient of this curve by the automorphism (— x, y) is the elliptic curve 
E: Y 2 = (X - 1){X 2 + bX + 1). Arguing as above, E has j-invariant 1728, and 
this leads to a — (excluded from the beginning) or a = (9/14) 2 , which is a 
contradiction since a would be a fourth power in F p 2 . □ □ 

After these results one is able to determine the zeta function of all twists of C 
when q is a square; the results are displayed in Table [14] In the cases where the 
Weil polynomial is (x — e^fq) 4 , e = ±1, the methods of section [2] are not sufficient 
to determine e; our computation of this sign follows from a study of the 4-torsion 
of an elliptic quotient of the corresponding curve. 

In order to deal with the case q nonsquare we need to discard more cases. 

Lemma 3.8. Suppose q nonsquare. If q = —1 (mod 4) then a and 1 — 4a cannot 
be both nonsquares. 

If q = 1 (mod 4) and a € (fc*) 2 then a € (fc*) 4 if and only if z ^ (k*) 2 . 

Proof. If a, 1 — 4a are both nonsquares the polynomial x 4 + x 2 + a is irreducible 
and the Weil polynomial of C is x 4 + q 2 by Table \3\ hence, the Weil polynomial 
of C (gife k 2 is (x 2 + q 2 ) 2 . If q = -1 (mod 4) we have a e fc* C (fc^) 4 and this 
contradicts Table [T4l 

Suppose q = 1 (mod 4) and a € (fc*) 2 ; by Lemma \TM 1 — 4a is also a square and 
z e fc*. If a G (fc*) 4 and z G (fc*) 2 we get W = (l) 6 , and (r,s) = (0, -2 q) by Table 
El we get a contradiction because the Jacobian J of C is simple ( MN02, Thm. 2.9]) 
and C has elliptic quotients over fc because the automorphisms (w 2 /x 1 (w 3 y)/x 3 ) 
are defined over fc. If a ^ (fc*) 4 and z ^ (fc*) 2 we get an analogous contradiction 
for the curve C u twisted by u(x,y) = (—x,iy). □ □ 

The results for the case q nonsquare follow now by the usual arguments and they 
are displayed in Tables HSl [TBI 

3.6. Twists of the supersingular curve C : y 2 = x 6 + ax 4 + bx 2 + 1. Recall that 
a, b G fc are special values satisfying (E| and making C supersingular; in particular 
p > 3. The curve C has four twists because Aut^-(C) = Aut(C) = {(±x,±y)} 
is commutative and has trivial Galois action. The Jacobian of C is fc-isogenous 
to the product E\ x Ei of the elliptic curves with Weierstrass equations y 2 — 
x 3 + ax 2 + bx + 1, y 2 — x 3 + bx 2 + ax + 1, obtained as the quotient of C by the 
respective automorphisms v — (—x,y), iv = (— x, — y). For q nonsquare, these 
elliptic curves have necessarily Weil polynomial x 2 + q and the Weil polynomial of 
Cis(x 2 +q) 2 . 

Lemma 3.9. If q is a square C has Weil polynomial (x ± yfq) 4 ■ 

Proof. By Theorem 13.21 and Proposition 12.21 C has Weil polynomial (x ± y/q) 4 or 
(x 2 — q) 2 . In both cases the elliptic curves Ei, E 2 have Weil polynomial (x ± ^/q) 2 
and we claim that they are isogenous. Since E(k) ~ (Z/(l ± ^fqj'L) 2 as an abelian 
group, our elliptic curves have four rational 2-torsion points and the polynomial 
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TABLE 5. Twists of the curve y 2 = x 5 - 1 for p = 2,3,4 (mod 5). The sign 
e — ±1 is determined by yj~q = e (mod 5). The last row provides eight inequivalent 
twists corresponding to the four nontrivial values of t £ k* /(k*) 5 





V 




(r, s) 


s.d. 


|Aut(C„)| 






q = ±2 (mod 5) 


(0,0) 




2 


y 2 =x*-l 


(x, y) 


q = —1 (mod 5) 


(0,2 9 ) 


no 


2 






g = 1 (mod 5) 


(-4eVg,6<j) 




10 


y 2 = tx 5 - 1, t (fc*) 5 


1-9 

(t 6 x, y) 


q = 1 (mod 5) 


(<V5, <?) 


no 
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TABLE 6. Twists of the curve y 2 — — x when q — — 1 (mod 8) 



c v 




(r,s) 


s.d. 


|Aut(C„)| 


y 2 — x' 3 — x 


(a, y) 


(0,2?) 


yes 


8 


y 2 = x 5 + x 




(0,2 9 ) 


yes 


4 


y 2 = (x 2 + l)(x 2 - 2tx - l)(x 2 + 'fx - 1) 
* 2 + l£(fc*) 2 




(0,-2g) 


yes 


24 


y" = (x 2 + l)(a; 4 - 4te J - 6x 2 + 4tx + 1), 
t 2 + 1 (fe*) 2 


(»'7i?rf) 


(0,0) 


yes 


4 


jy 2 = K b - (t + 3)x'° + 5(^|^i)a: 4 + 5(s - l)x 3 
+5( 2 ~^ 3 )a; 2 + (t - 3)a; + 1 irrcd., s 2 + t 2 = -2 


/<D-i 2(l-i)»\ 


(0,9) 


no 


6 



x + ax 2 + bx + 1 has three roots e±, e^, £ k. Since e\C2e-i = 1, either one or 
three of these roots are squares. If only one root is a square we have W = (1) 2 (2) 2 , 
W v — (1) 4 (2) and C, C v have both Weil polynomial (x 2 ± q) 2 , in contradiction 
with Theorem 13.21 Hence, the three roots are squares, W — (l) 6 , and C has Weil 
polynomial (x ± ^fq) A by Corollary 13. 31 □ □ 

The zeta function of the twists of C is obtained from Propositions 12.21 and 12.31 
The results are displayed in Table [TTl For q square the sign of (x ± y/q) 4 can be 
determined by analyzing the 4-torsion of the elliptic curve y 2 — x 3 + ax 2 + bx + 1 . 

Finally, there are special curves over k whose geometric model y 2 = x 6 + ax 4 + 
bx 2 + 1 is not defined over k (cf. |Car03[ Sect.l]). It is straightforward to apply the 
techniques of this paper to determine their zeta function too. 

4. Appendix 

In this appendix we display in several tables the computation of the zeta func- 
tion of the supersingular curves of genus 2 with many automorphisms. For each 
curve C v , we exhibit the number of fc-automorphisms and the pair of integers (r, s) 
determining the Weil polynomial fj v (x) — x 4 + rx 3 + sx 2 + qrx + q 2 of C v . In the 
column labelled "s.d" we indicate if C is self-dual. For the non-self-dual curves we 
exhibit only one curve from the pair C v , C' v . 

We denote by tq, i G k a primitive third, fourth root of unity. For n a positive 
integer and x S k* we define 

Vn{x) — 1 if x S (k*) n , v n (x) = —1 otherwise . 

In all tables the parameters s, t take values in k* . 

Conclusion. We show that the zeta function of a supersingular curve of genus two 
is almost determined by the Galois structure of a finite set easy to describe in terms 
of a defining equation. For curves with many automorphisms this result is refined 
to obtain a direct (non-algoritmic) computation of the zeta function in all cases. As 
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TABLE 7. Twists of the curve y 2 — x 5 — x when q — 5 (mod 8) 



c v 




p 


(r, s) 


s.d. 


|Aut(G'„)| 


y 2 — x 5 — x 




p > 5 
p = 5 


(0,-2g) 


yes 


24 
120 


y 2 = x 5 - 4x 


(-x.il/) 




(0,2g) 


yes 


8 1 


y A — x^ — 2x 


(«, ±£i/) 




(0,0) 


yes 


4 


y 2 = (x 2 + 2)(x 4 - 12x 2 + 4) 


(i>7§xM 


p > 5 
p — 5 


(0,2g) 


yes 


4 
12 


v 2 = /('■*)/( ■*) 

f(t, x) = x 3 - tx 2 + (t - 3)x + 1 irred. 


fx-i 2(l-i)»\ 


p > 5 
p — 5 


(0,9) 


no 
yes 


6 


y 2 = x a - x - t, tr fc/Ff . (t) = 1 


(x + 1,1/) 


p — 5 


(V5^,3g) 


no 


10 


y 2 - x 6 + tx 5 + (1 - t)x + 2, irrod. 


*.x-l ' ( X + 1)» ; 


p — 5 


(0,-9) 


yes 


6 



Table 8. Twists of the curve y 2 — x 5 — x when p = 5, 7 (mod 8) and q is a 
square. Here e — (—1/^/q) and e' — (S/^/q) 



C V 




P 


(r, s) 


s.d. 


|Aut(C„)| 


2 5 

y — a; — x 


(z, y) 


p > 5 
p — 5 


(-4e^q, 6g) 


no 


48 
240 


y 2 =x"-t 2 x, t<jL{k*Y 


(-x, ij/) 




(0,2g) 


yes 


8 


y 2 =x a -tx, tg(k*) 2 


(«,^y) 




(0,0) 


no 


8 


y 2 = (x 2 - t)(x 4 + 6tx 2 + t 2 ), 
t <£ (k'f 




p > 5 
p — 5 


(0,-2g) 


yes 


4 
12 


y 2 = (x 3 - t)(x 6 - (15V3 - 26)t), 
t £ (fc*) 3 




p = 5 


(2e'yg, 3g) 


no 


6 
12 


J/ 14 = a; 5 - a; - t, tr fc/Ff . (t) = 1 


(x+ 1,1/) 


p — 5 




no 


10 


y 2 = x e + tx 5 + (1 - t)x + 2, irred. 


^ 3 V2y 
U-l> (x + l)3 <* 


p — 5 


(0,9) 


no 
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TABLE 9. Twists of the curve y 2 — x G — 1 when q = — 1 (mod 3), p ^ 5. Here e — (— 





V 


(r, s) 


s.d. 


|Aut(C„)| 


y 2 = x° - 1 


(x, y) 


(0,2g) 


iff e = -1 


6 + 2e 


l/ 2 =x--t, tg(k*) 2 


(-x, -y) 


(0,2g) 


iff e = 1 


6 - 2e 


y 2 = x(x 2 - l)(x 2 - 9) 


( l *y \ 


(0, -2£«) 


yes 


12 


y 2 = (i* - 2stx 3 + (7s + l)x 2 + 2tsx + 1). 
•(a; 2 - f x - 1), i 2 + 4 e fc* \ (fe*) 2 , s" 1 = t 2 + 3 


/ l 'a \ 
V - x > ^T3" / 


(0, 2eg) 


yes 


12 


y 2 = x" + 6tx a + 15sx 4 + 20tsx 3 + 15s 2 x 2 + 
+6ts 2 x + s 3 , s = t 2 - 4 (fc*) 2 , 
gcd(x<« +1 >/ 3 - l,x 2 - tx + 1) = 1 




(0, eg) 


yes 


6 


y^ =x° + 6x : ' + 15sx 4 + 20sx 3 + 15s 2 x 2 + 
+6s 2 x + s 3 , s = t 2 /(t 2 + 4) (fe*) 2 , 
gcd(x< <J + 1 »/ 3 + 1, x 2 - tx - 1) = 1 




(0,-eg) 


yes 


6 



TABLE 10. Twists of the curve y 2 — x 6 — 1 when p — —1 (mod 3), p ^ 5 and q 
is a square. Here e — (—S/^/q) 







(r, s) 


s.d. 


|Aut(C v )| 


y — x — 1 


(»! V) 


(-4e,/g,6g) 


no 


24 


y 2 = x b - t'\ t (fc*) 2 


(-x, y) 


(0,-2g) 


yes 


12 


y^=x°-t 2 , tg(k') 3 


(v*, v) 


(2eV?>3g) 


no 


12 


y 2 =x°-t, t ((fc*) 2 U (fe*) 3 ) 


(-r/x, -j/) 


(0,9) 


no 


12 


y 2 =x(x 2 + 3t)(x 2 + |), t^(fc*) 2 


/ l »yi 


(0,2g) 


yes 


4 


y 2 = x 6 + 15tx 4 + 15t 2 x 2 + t 3 , t0(fe*) 2 




(0,-2g) 


yes 


4 
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TABLE 1 1 . Twists of the supersingular curve y 2 — x 6 +x 3 +a, o^O, 1/4, -1/50, 
when q = — 1 (mod 3). Here e — v^{a) and A is the cubic root of a in 



c„ 




(r, s) 


s.d. 


|Aut(C)| 


j/ 2 = x b + k' 1 + a 




(0,2g) 


iff e = - 1 


3 + e 


y 2 = 0" 3 (x - S) b - g(x) 3 + a0 3 (x - 0") b 
g(x) min. polyn. of 8 £ k 2 \ k, N fc , /fc (e) = A -1 




(0,2eg) 


iff e = -1 


9 + 3e 


y 2 = 0{x - v)" - g(xY + a6- L '(x - r, 2 )" 

g (x) = x 2 + x + 1, e e fe 2 \ (fej) 3 . N fc2/fc (e) = a 




(0, -eg) 


no 


6 



Table 12. Twists of the supersingular curve y 2 — x & -\-x 3 -\-a, a ^ 0, 1/4, —1/50, 
when q = 1 (mod 3) and q is nonsquare. Here A is a cubic root of a in k and n — 3, 
if a G (&*) 3 , whereas A = a, n = 1, if a (fc*) 3 





V 


^3(0) 


(r, s) 


s.d. 


|Aut(C„)| 


j/ 2 = x 6 + x 3 + a 


(x, y) 


1 

-1 


(0,-2g) 
(0,9) 


yos 
no 


6 


y A — x° -\- tx 3 + t 2 a, t (k*) 3 
y 2 = x 6 + ax 3 + a 3 


9-1 

(t 3 x ,y) 


1 

-1 


(0,9) 
(0,-29) 


no 

yos 


6 


y 2 = 0~ n {x - 0)" - g(x)' 6 + a0"(x - 9") b 
g(x) min. polyn. of e k 2 \ k, N k7 / k (8) = A~ x 






(0,29) 


yos 


2 



Table 13. Twists of the supersingular curve y 2 = x 6 +x 3 +a, o^0, 1/4, -1/50, 
when q is a square. Here e — ( — 3/y/q). Also, A is a cubic root of a in k and n — 3, 
if a G (fc*) 3 , whereas A = a, n = 1, if a (/c*) 3 





V 


^3(0) 


(r,s) 


s.d. 


|Aut(C)| 


j/ 2 = it 6 + x 3 + a 


(x, y) 


1 

-1 


(_ 4e yg, 69) 

(2eV9, 39) 


no 


12 
6 


j/ 2 = 2;° + tx 3 + t 2 a, t^(k') 3 
y 2 = x 6 + ax 3 + a 3 


9-1 

(t 3 x,y) 


1 

-1 


(2eV9, 39) 
{-4e^q, 69) 


no 


6 
12 


y 2 = 9~ n (x - 0)° - g(x) 3 + a0 n (x - 9")" 
g(x) min. polyn. of £ k 2 \ k, N k9 j k (6) = A' 1 






(0,-29) 


no 


4 



Table 14. Twists of the supersingular curve y 2 — x 5 + x 3 + ax, a 7^ 
0,1/4,9/100, when g is a square. The last row provides two inequivalent twists 
according to the two values of y/a. Here e — — (— l/\A?)f4 (2) and e' — 
— (— l/\/q)v4{tz), where z 2 -\- z -\- a — 





V 


1/4 (a) 


(r, s) 


s.d. 


|Aut(C„)| 


2 5 , 3 , 

y — x -\- x + ax 


(x, y) 


1 

-1 


(4 £ y9, 69) 
(0,29) 


no 

yos 


8 
4 


y 2 = x 5 + tx 3 + a£ 2 :c, t (k*) 2 


9-1 

(-x,t^y) 


1 

-1 


(0,29) 
(4e'V9, 69) 


yos 
no 


4 

8 


y 2 =g(x)($ :i (x-$*)* + 9(x)' A + 
+ae- 2 (x-0) A ) , N fc2/fc (^)^ 
g(x) min. polyn. oi £ k 2 \ k 






(0,-29) 


yos 


4 



TABLE 15. Twists of the supersingular curve y 2 — x 5 + x 3 + ace, a ^ 
0, 1/4, 9/100, when q is nonsquare and a £ (k*) 2 



c v 


V 


(-1/p) 


(r, s) 


s.d. 


|Aut(C„)| 


y 2 = X s + x 3 + ax 


(x, y) 


i 

-i 


(0,0) 
(0,29) 


no 
yes 


4 
2 


y z = (x 2 - o) (0(x - v^) 4 + (x 2 - a) 2 + 
+a0- 1 (x + v^) 4 ) , 6»efe 2 , N fe , /fc (0) = o 




i 

-i 


(0,29) 
(0,0) 


yes 
no 


2 

4 
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Table 16. Twists of the supcrsingular curve y 2 — + a; 3 + aa^, a ^ 
0, 1/4, 9/100, when q is nonsquarc and a £ (fc* ) 2 . Here e — ( — 1/p) . If 
p = —1 (mod 4) we assume that ^/a belongs to (A;*) 2 







Vi{a) 


(r, s) 


s.d. 


|Aut(C„)| 


y 2 = x 5 + x 3 + ax 




1 

-1 


(0,2g) 
(0,-2g) 


iff e = -1 

yes 


6 + 2e 
4 


y 2 = x 5 + tx 3 + at 2 x, t<£(k*) 2 




1 

-1 


(0, -2eg) 
(0,2g) 


yes 
no 


4 
8 


y 2 = g (x)(e 2 (x-e°r+g(x) 2 + 
+ae- 2 (x-e) 4 ), N fc2/(c (0) = v^ 
g{x) min. polyn. of 6 £ &2 \ 






(0,2g) 


iff e= 1 


6 - 2e 


= q(: E )(e 2 (z-0T+9W + 
+ae- 2 (x-9) 4 ) , N fc2/fc (9) = -Vo 
g(x) min. polyn. of £ feg \ 






(0,2eg) 


yes 


4 



Table 17. Twists of the supcrsingular curve y 2 — x G + aa: 4 -J- bx' 2 + 1 satisfying ([5j 





V 




(r,s) 


s.d. 


[Aut(C„)| 


y 2 = x 6 + ax 4 + bx 2 + 1 


( x > y) 


q nonsq. 
q square 


(0,2g) 
(±4yq,6q) 


no 


4 


1/^=2;° + ate 4 + bt 2 a; 2 + t 3 
t <£ (fc*) 2 


-w) 


q nonsq. 
q square 


(0,2g) 
(0,-2g) 


no 


4 



an application one gets a direct computation of the cryptographic exponent of the 
Jacobian of these curves. Also, the computation of the zeta function is necessary to 
determine the structure of the endomorphism ring of the Jacobian and to compute 
distortion maps for the Weil and Tate pairings. 

Acknowledgement. It is a pleasure to thank Christophe Ritzenthaler for his help 
in finding some of the equations of the twisted curves. 
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